Subject: Restricted Pine and Pico

From: Rob Hamm <[email-masked]>
Date: Mon, 27 Jan 1997 16:16:24 -0800 (PST)

I've seen questions like the following in the archives, but no real final
answers, so...

How can I configure Pine and Pico so they are quite secure (on a Unix machine)?

	specifically;

		- no shell escapes at all
		- no suspending of pine (full removal of ctrl-Z)
		- no ability for PICO to read in files that have
		  a "/" in them
		
I'm aware of Rsh, but that doesn't prevent reading (for example) of /etc/passwd.
I saw a reference in the archives to pine.conf.fixed, but can't find
that file in my 3.95 distribution.

Thabks for any/all help!

-- 
Rob Hamm
Systems and Networks Administrator
University College of the Fraser Valley
http://www.ucfv.bc.ca/cats/

---

From: [email-masked] (Sylvain Robitaille)
Date: 30 Jan 1997 04:45:45 GMT

>that file in my 3.95 distribution.

I don't know how I could help with your needs for pico, but for pine it's
pretty simple. You create pine.conf.fixed. In it, you include the settings
you don't want your users to be able to change. The settings in
pine.conf.fixed take precedence over any others, so be sure to set only
those items you want to remain fixed.

Quoted right out of the config.html file which came with the pine 3.95
distribution:
   
   You may get a sample/fresh copy of the system configuration file by
   running pine -conf. The result will be printed on the standard output
   with short comments describing each variable. (The online help in the
   Setup/Config screen provides longer comments.) If you need to fix some
   of the configuration variables, you would use the same template for the
   fixed configuration file as for the regular system-wide configuration
   file. (If it isn't clear, the purpose of the fixed configuration file
   is to allow system administrators to restrict the configurability of
   Pine. It is by no means a bullet-proof method.) Pine will automatically
   create the personal configuration file the first time it is run, so
   there is no need to generate a sample. Pine reads and writes the
   personal configuration file occasionally during normal operation.

Hope that helps.

BTW, if you're worried about the security of /etc/passwd, just install a
shadow password system. There's one for Linux systems at sunsite.unc.edu
in /pub/Linux/system/Admin. Certainly there are similar utilities for
other versions of Unix.

-- 
----------------------------------------------------------------------
Sylvain Robitaille
[email-masked]          http://alcor.concordia.ca/~sp_robi

It's OBVIOUS ... The FURS never reached ISTANBUL ... You were an EXTRA
in the REMAKE of "TOPKAPI" ... Go home to your WIFE ... She's making
FRENCH TOAST!
----------------------------------------------------------------------